That observation would primarily validate another control: enable supported Application Gateway autoscaling with appropriate minimum and maximum capacity settings. Autoscale can adjust eligible Application Gateway capacity as workload traffic changes. The situation calls for evidence that a representative request or response exhibits the intended rewritten value while unrelated paths remain unchanged.

That observation would primarily validate another control: configure appropriate multi-site listeners and host-based routing rules on Application Gateway. Host-based layer-7 routing matches incoming hostnames to the right backend listener and routing rule. The situation calls for evidence that a representative request or response exhibits the intended rewritten value while unrelated paths remain unchanged.

That observation would primarily validate another control: configure a custom Application Gateway health probe with the correct host header, protocol and probe path. Gateway backend health uses probe settings that must match the application's listener and host expectations. The situation calls for evidence that a representative request or response exhibits the intended rewritten value while unrelated paths remain unchanged.

WAF policy association and custom rule match conditions determine where application-layer controls apply. However, the option would implement scope and associate appropriate WAF security policies to supported domains or path patterns; the scenario instead requires define deliberate WAF enforcement responsibilities and correlate diagnostic rules across edge and regional layers. The differentiating evidence is that a controlled test shows the intended enforcement layer with consistent logged request identifiers.

Targeted tuning preserves the broader managed rule set while addressing a justified false positive. However, the option would implement apply a narrowly scoped WAF exclusion or supported per-rule override instead of disabling all protection; the scenario instead requires define deliberate WAF enforcement responsibilities and correlate diagnostic rules across edge and regional layers. The differentiating evidence is that a controlled test shows the intended enforcement layer with consistent logged request identifiers.

WAF custom rate limits and bot controls can mitigate application-layer request floods when correctly scoped. However, the option would implement configure supported WAF rate-limit or bot protection rules at the appropriate edge scope; the scenario instead requires define deliberate WAF enforcement responsibilities and correlate diagnostic rules across edge and regional layers. The differentiating evidence is that a controlled test shows the intended enforcement layer with consistent logged request identifiers.

Network rules are appropriate for transport and IP-address traffic that is not evaluated as HTTP hostnames. However, the option would implement configure a narrowly scoped Azure Firewall network rule for the required transport, source and destination; the scenario instead requires combine correct UDR steering through Azure Firewall with suitable firewall policy and NSG defense in depth. The differentiating evidence is that a sample denied FQDN is blocked at Azure Firewall while subnet NSG rules continue enforcing local segmentation.

FQDN-based network rules require consistent DNS resolution between client and firewall evaluation. However, the option would implement enable and consistently use Azure Firewall DNS proxy where necessary for FQDN-based network filtering; the scenario instead requires combine correct UDR steering through Azure Firewall with suitable firewall policy and NSG defense in depth. The differentiating evidence is that a sample denied FQDN is blocked at Azure Firewall while subnet NSG rules continue enforcing local segmentation.

Central inspection is effective only if the policy meaningfully restricts destination and transport access. However, the option would implement replace blanket allows with least-privilege application and network rule collections; the scenario instead requires combine correct UDR steering through Azure Firewall with suitable firewall policy and NSG defense in depth. The differentiating evidence is that a sample denied FQDN is blocked at Azure Firewall while subnet NSG rules continue enforcing local segmentation.

That observation would primarily validate another control: configure Azure Traffic Manager with the correct routing method and endpoint health checks. Traffic Manager answers DNS queries based on endpoint health and routing policy rather than proxying HTTP traffic. The situation calls for evidence that external clients connect through the public frontend and failed backends stop receiving traffic.

That observation would primarily validate another control: use Traffic Manager Performance routing with enabled healthy endpoints. Performance routing maps DNS clients to suitable regional endpoints using the Traffic Manager performance model. The situation calls for evidence that external clients connect through the public frontend and failed backends stop receiving traffic.

That observation would primarily validate another control: configure Traffic Manager Weighted routing across the regional endpoints. Weighted Traffic Manager policies influence DNS answer distribution across eligible healthy endpoints. The situation calls for evidence that external clients connect through the public frontend and failed backends stop receiving traffic.

Host-based layer-7 routing matches incoming hostnames to the right backend listener and routing rule. However, the option would implement configure appropriate multi-site listeners and host-based routing rules on Application Gateway; the scenario instead requires configure a custom Application Gateway health probe with the correct host header, protocol and probe path. The differentiating evidence is that the custom probe reports healthy and routed requests are delivered to the backend.

HTTP redirection returns a redirect status and location rather than proxying to a legacy backend. However, the option would implement configure an Application Gateway redirect configuration associated with the right listener or rule; the scenario instead requires configure a custom Application Gateway health probe with the correct host header, protocol and probe path. The differentiating evidence is that the custom probe reports healthy and routed requests are delivered to the backend.

Regional WAF inspection operates at layer 7 on Application Gateway and can apply managed rules to HTTP requests. However, the option would implement attach a supported Application Gateway WAF policy in the intended enforcement mode; the scenario instead requires configure a custom Application Gateway health probe with the correct host header, protocol and probe path. The differentiating evidence is that the custom probe reports healthy and routed requests are delivered to the backend.

Private Link origin connectivity requires accepted connection state and valid private endpoint/DNS behavior. However, the option would implement approve the required private endpoint connection and verify the origin's private link health; the scenario instead requires associate an appropriate Azure Front Door WAF security policy with protected endpoint domains and patterns. The differentiating evidence is that a permitted benign request succeeds and an approved safe WAF test produces a matching edge policy action.

Front Door cache purging invalidates stale edge copies in supported scopes. However, the option would implement use the supported Front Door purge cache operation for affected URL patterns; the scenario instead requires associate an appropriate Azure Front Door WAF security policy with protected endpoint domains and patterns. The differentiating evidence is that a permitted benign request succeeds and an approved safe WAF test produces a matching edge policy action.

Front Door rules can modify edge request handling before forwarding to origin services. However, the option would implement create Front Door rules for supported redirect or URL rewrite behavior on the matching route; the scenario instead requires associate an appropriate Azure Front Door WAF security policy with protected endpoint domains and patterns. The differentiating evidence is that a permitted benign request succeeds and an approved safe WAF test produces a matching edge policy action.

Destination NAT maps external firewall access to a private destination and requires an appropriate routed path. However, the option would implement configure a DNAT rule with the intended public destination, private target and matching security controls; the scenario instead requires correlate firewall decision logs with source and destination effective routes and return connectivity. The differentiating evidence is that a packet trace and log entry identify the failing layer and the corrected flow succeeds both directions.

FQDN-based network rules require consistent DNS resolution between client and firewall evaluation. However, the option would implement enable and consistently use Azure Firewall DNS proxy where necessary for FQDN-based network filtering; the scenario instead requires correlate firewall decision logs with source and destination effective routes and return connectivity. The differentiating evidence is that a packet trace and log entry identify the failing layer and the corrected flow succeeds both directions.

Azure Firewall provisioning requires its reserved subnet and adequate address capacity. However, the option would implement reserve the correctly named AzureFirewallSubnet with supported capacity and remove incompatible occupants; the scenario instead requires correlate firewall decision logs with source and destination effective routes and return connectivity. The differentiating evidence is that a packet trace and log entry identify the failing layer and the corrected flow succeeds both directions.

Client TLS negotiation uses the frontend listener certificate, which is separate from backend TLS settings. However, the option would implement replace or bind the appropriate trusted TLS certificate to the Application Gateway HTTPS listener; the scenario instead requires configure an Application Gateway rewrite rule set matching the required request or response conditions. The differentiating evidence is that a representative request or response exhibits the intended rewritten value while unrelated paths remain unchanged.

Gateway backend health uses probe settings that must match the application's listener and host expectations. However, the option would implement configure a custom Application Gateway health probe with the correct host header, protocol and probe path; the scenario instead requires configure an Application Gateway rewrite rule set matching the required request or response conditions. The differentiating evidence is that a representative request or response exhibits the intended rewritten value while unrelated paths remain unchanged.

Host-based layer-7 routing matches incoming hostnames to the right backend listener and routing rule. However, the option would implement configure appropriate multi-site listeners and host-based routing rules on Application Gateway; the scenario instead requires configure an Application Gateway rewrite rule set matching the required request or response conditions. The differentiating evidence is that a representative request or response exhibits the intended rewritten value while unrelated paths remain unchanged.

Front Door edge caching improves static content delivery only when caching policies respect dynamic or private data. However, the option would implement configure Front Door caching for eligible static routes with appropriate cache rules and bypass for sensitive content; the scenario instead requires create Front Door rules for supported redirect or URL rewrite behavior on the matching route. The differentiating evidence is that a controlled request receives the required destination or reaches the rewritten origin path.

The client-to-edge and edge-to-origin TLS connections are distinct and must both be configured. However, the option would implement configure HTTPS for the Front Door endpoint and HTTPS origin forwarding with valid origin certificates; the scenario instead requires create Front Door rules for supported redirect or URL rewrite behavior on the matching route. The differentiating evidence is that a controlled request receives the required destination or reaches the rewritten origin path.

Front Door WAF evaluates incoming HTTP requests at the edge before routing to origins. However, the option would implement associate an appropriate Azure Front Door WAF security policy with protected endpoint domains and patterns; the scenario instead requires create Front Door rules for supported redirect or URL rewrite behavior on the matching route. The differentiating evidence is that a controlled request receives the required destination or reaches the rewritten origin path.

Azure Load Balancer distributes layer-4 traffic to backend endpoints while an internal frontend stays private. However, the option would implement create an internal Azure Load Balancer with a private frontend and eligible backend pool; the scenario instead requires configure appropriate Load Balancer probe and rollout health gating for backend readiness. The differentiating evidence is that during a controlled single-instance failure the unhealthy node is excluded and healthy nodes continue serving.

Load-balancing rules map frontend flows to backend endpoints; HA ports can address multiple ports in eligible designs. However, the option would implement configure suitable load-balancing rules including HA ports where the chosen internal design supports them; the scenario instead requires configure appropriate Load Balancer probe and rollout health gating for backend readiness. The differentiating evidence is that during a controlled single-instance failure the unhealthy node is excluded and healthy nodes continue serving.

Layer-4 Load Balancer does not inspect URL paths; path-based routing is a layer-7 capability. However, the option would implement use an application-layer gateway rather than Azure Load Balancer for URL-based HTTP routing; the scenario instead requires configure appropriate Load Balancer probe and rollout health gating for backend readiness. The differentiating evidence is that during a controlled single-instance failure the unhealthy node is excluded and healthy nodes continue serving.

FQDN-based network rules require consistent DNS resolution between client and firewall evaluation. However, the option would implement enable and consistently use Azure Firewall DNS proxy where necessary for FQDN-based network filtering; the scenario instead requires reserve the correctly named AzureFirewallSubnet with supported capacity and remove incompatible occupants. The differentiating evidence is that the firewall provisions successfully and its health and data-plane traffic meet deployment checks.

Firewall Policy centralizes supported rule collections and can be associated with multiple firewall instances. However, the option would implement use Azure Firewall Manager or centrally managed Firewall Policy with suitable inheritance; the scenario instead requires reserve the correctly named AzureFirewallSubnet with supported capacity and remove incompatible occupants. The differentiating evidence is that the firewall provisions successfully and its health and data-plane traffic meet deployment checks.

Azure Firewall policy evaluation order and processing rules determine which matching decision applies. However, the option would implement review Firewall Policy rule-collection-group and collection processing order and correct priorities; the scenario instead requires reserve the correctly named AzureFirewallSubnet with supported capacity and remove incompatible occupants. The differentiating evidence is that the firewall provisions successfully and its health and data-plane traffic meet deployment checks.